Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example:

http://example.com/param1=123&param2=name&param3=<script type='text/javascript'>alert('pwnd');</script>

But if the application receives its payload not through url query parameter but through Post request body, how can attacker lure victim to perform xss by simply providing url to click? You can definitely, tamper with post body values by inserting code, but that will not be considered as XSS, since that is usually done in apps like fiddler or curl which does not run response code. So how can xss occur in this applications. As far as I understand xss does not persist data on the server, but rather affects the user who is making that request.

2 Answers 2


The issue exists if the form is csrfable, then the attacker.com website can contain some JavaScript that makes a POST request to victim.com in order to exploit the xss. It is also exploitable through other means like a HTTP 307 response.

  • I think your answer is correct. I have not thought about attackers website can make you POST forms to your already authenticated victims website. Which is what CSRF attacks are. So I guess reflected xss is very similar to csrf attacks then?
    – DoodleKana
    Commented Feb 3, 2015 at 17:35
  • if the form is not csrfable, can there be still any xss vulnerability exist?
    – DoodleKana
    Commented Feb 3, 2015 at 18:14
  • Yes, it still exist, but the likelihood of exploitation drops of significantly. If you take a look at the Browser Exploitation Framework (BeEF) you can see many examples on how various xss vulnerabilities can be exploited
    – wireghoul
    Commented Feb 3, 2015 at 21:33

There is stored XSS and DOM based XSS which do not rely upon a GET parameter. POST based XSS is exploited using a simple cross-site post request, which can be triggered using the following HTML and JavaScript

<form id=xss action=http://target/action method=POST>
  <input name=param3 value="'+alert(document.cookie)+'">
  <input type=submit>

Once the XSS payload stored in param3 is executed within the context of http://target, the Same-Origin Policy is bypassed.

  • I forgot to mention in my question that the type of xss I was referring to is reflected xss. The server does not have the payload stored(not stored xss). But the returning error message has the payload in it(reflected xss). But how does attacker make victim to send the payload through POST in reflective xss?
    – DoodleKana
    Commented Feb 3, 2015 at 16:25
  • @DoodleKana the attacker copy pastes the HTML and JavaScript in the above answer, and then gets a victim to click on a URL that loads that exploit. method=POST
    – rook
    Commented Feb 3, 2015 at 19:31
  • your right, I think @ wireghoul has also similar answer.
    – DoodleKana
    Commented Feb 3, 2015 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .